231 Commits (5dd73d029eff32668b3ca69b7fb8529fc7c58745)

Author	SHA1	Message	Date
Richard van der Hoff	de6f892065	Add a comment about SSLv23_METHOD (#8043)	4 years ago
Patrick Cloke	2a89ce8cd4	Convert the crypto module to async/await. (#8003)	4 years ago
Patrick Cloke	c978f6c451	Convert federation client to async/await. (#7975)	4 years ago
Dagfinn Ilmari Mannsåker	a3f11567d9	Replace all remaining six usage with native Python 3 equivalents (#7704)	5 years ago
Richard van der Hoff	39230d2171	Clean up some LoggingContext stuff (#7120) ... * Pull Sentinel out of LoggingContext ... and drop a few unnecessary references to it * Factor out LoggingContext.current_context move `current_context` and `set_context` out to top-level functions. Mostly this means that I can more easily trace what's actually referring to LoggingContext, but I think it's generally neater. * move copy-to-parent into `stop` this really just makes `start` and `stop` more symetric. It also means that it behaves correctly if you manually `set_log_context` rather than using the context manager. * Replace `LoggingContext.alive` with `finished` Turn `alive` into `finished` and make it a bit better defined.	5 years ago
Richard van der Hoff	c37db0211e	Share SSL contexts for non-federation requests (#7094) ... Extends #5794 etc to the SimpleHttpClient so that it also applies to non-federation requests. Fixes #7092.	5 years ago
Patrick Cloke	06eb5cae08	Remove special auth and redaction rules for aliases events in experimental room ver. (#7037)	5 years ago
Patrick Cloke	509e381afa	Clarify list/set/dict/tuple comprehensions and enforce via flake8 (#6957) ... Ensure good comprehension hygiene using flake8-comprehensions.	5 years ago
Richard van der Hoff	7f93eb1903	pass room_version into compute_event_signature (#6807)	5 years ago
Richard van der Hoff	2a81393a4b	Pass room_version into add_hashes_and_signatures	5 years ago
Richard van der Hoff	ba897a7590	Fix some test failures when frozen_dicts are enabled (#6642) ... Fixes #4026	5 years ago
Richard van der Hoff	4b36b482e0	Fix exception when fetching notary server's old keys (#6625) ... Lift the restriction that *all* the keys used for signing v2 key responses be present in verify_keys. Fixes #6596.	5 years ago
Michael Kaye	f85b9842f0	Don't encode object as UTF-8 string if not needed. ... I believe that string formatting ~10-15 sized events will take a proportion of CPU time.	5 years ago
Amber Brown	850dcfd2d3	Fix well-known lookups with the federation certificate whitelist (#5997)	5 years ago
Andrew Morgan	4548d1f87e	Remove unnecessary parentheses around return statements (#5931) ... Python will return a tuple whether there are parentheses around the returned values or not. I'm just sick of my editor complaining about this all over the place :)	5 years ago
Erik Johnston	7af5a63063	Fixup review comments	5 years ago
Richard van der Hoff	ef1c524bb3	Improve error msg when key-fetch fails (#5896) ... There's no point doing a raise_from here, because the exception is always logged at warn with no stacktrace in the caller. Instead, let's try to give better messages to reduce confusion. In particular, this means that we won't log 'Failed to connect to remote server' when we don't even attempt to connect to the remote server due to blacklisting.	5 years ago
Erik Johnston	97cbc96093	Only sign when we respond to remote key requests	5 years ago
Erik Johnston	5906be8589	Add config option for keys to use to sign keys ... This allows servers to separate keys that are used to sign remote keys when acting as a notary server.	5 years ago
Erik Johnston	a9bcae9f50	Share SSL options for well-known requests	5 years ago
Amber Brown	4806651744	Replace returnValue with return (#5736)	5 years ago
Richard van der Hoff	dcca56baba	Add a delay to key lookup lock release to fix stack overflow ... A tactical call_later here should fix #5723	5 years ago
Richard van der Hoff	c7095be913	Refactor Keyring._start_key_lookups ... There's an awful lot of deferreds and dictionaries flying around here. The whole thing can be made much simpler and achieve the same effect.	5 years ago
Amber Brown	463b072b12	Move logging utilities out of the side drawer of util/ and into logging/ (#5606)	5 years ago
Amber Brown	be3b901ccd	Update the TLS cipher string and provide configurability for TLS on outgoing federation (#5550)	5 years ago
Amber Brown	32e7c9e7f2	Run Black. (#5482)	6 years ago
Richard van der Hoff	81b8fdedf2	rename gutwrenched attr	6 years ago
Richard van der Hoff	efe7b3176e	Fix federation connections to literal IP addresses ... turns out we need a shiny version of service_identity to enforce this correctly.	6 years ago
Richard van der Hoff	d11c634ced	clean up impl, and import idna directly	6 years ago
Richard van der Hoff	88d7182ada	Improve startup checks for insecure notary configs (#5392) ... It's not really a problem to trust notary responses signed by the old key so long as we are also doing TLS validation. This commit adds a check to the config parsing code at startup to check that we do not have the insecure matrix.org key without tls validation, and refuses to start without it. This allows us to remove the rather alarming-looking warning which happens at runtime.	6 years ago
Richard van der Hoff	c2b6e945e1	Share an SSL context object between SSL connections ... This involves changing how the info callbacks work.	6 years ago
Richard van der Hoff	9fbb20a531	Stop hardcoding trust of old matrix.org key (#5374) ... There are a few changes going on here: * We make checking the signature on a key server response optional: if no verify_keys are specified, we trust to TLS to validate the connection. * We change the default config so that it does not require responses to be signed by the old key. * We replace the old 'perspectives' config with 'trusted_key_servers', which is also formatted slightly differently. * We emit a warning to the logs every time we trust a key server response signed by the old key.	6 years ago
Richard van der Hoff	cea9750d11	Associate a request_name with each verify request, for logging ... Also: * rename VerifyKeyRequest->VerifyJsonRequest * calculate key_ids on VerifyJsonRequest construction * refactor things to pass around VerifyJsonRequests instead of 4-tuples	6 years ago
Richard van der Hoff	2615c6bd9e	Clean up debug logging (#5347) ... Remove some spurious stuff, clarify some other stuff	6 years ago
Richard van der Hoff	016af01598	Rename VerifyKeyRequest.deferred field (#5343) ... it's a bit confusing	6 years ago
Richard van der Hoff	4d08b8f30c	Don't do long retries when calling the key notary server. (#5334) ... It takes at least 20 minutes to work through the long_retries schedule (11 attempts, each with a 60 second timeout, and 60 seconds between each request), so if the notary server isn't returning within the timeout, we'll just end up blocking whatever request is happening for 20 minutes. Ain't nobody got time for that.	6 years ago
Richard van der Hoff	c5d60eadd5	Notary server: make requests to origins in parallel ... ... else we're guaranteed to time out.	6 years ago
Richard van der Hoff	def5ea4062	Don't bomb out on direct key fetches as soon as one fails	6 years ago
Richard van der Hoff	06a1f3e207	Reduce timeout for outbound /key/v2/server requests.	6 years ago
Richard van der Hoff	fec2dcb1a5	Enforce validity period on server_keys for fed requests. (#5321) ... When handling incoming federation requests, make sure that we have an up-to-date copy of the signing key. We do not yet enforce the validity period for event signatures.	6 years ago
Richard van der Hoff	3600f5568b	Stop overwriting server keys with other keys ... Fix a bug where we would discard a key result which the origin server is no longer returning. Fixes #5305.	6 years ago
Richard van der Hoff	8ea2f756a9	Remove some pointless exception handling ... The verify_request deferred already returns a suitable SynapseError, so I don't really know what we expect to achieve by doing more wrapping, other than log spam. Fixes #4278.	6 years ago
Richard van der Hoff	a82c96b87f	Rewrite get_server_verify_keys, again. ... Attempt to simplify the logic in get_server_verify_keys by splitting it into two methods.	6 years ago
Richard van der Hoff	099829d5a9	use attr.s for VerifyKeyRequest ... because namedtuple is awful	6 years ago
Richard van der Hoff	fa1b293da2	Simplification to Keyring.wait_for_previous_lookups. (#5250) ... The list of server names was redundant, since it was equivalent to the keys on the server_to_deferred map. This reduces the number of large lists being passed around, and has the benefit of deduplicating the entries in `wait_on`.	6 years ago
Richard van der Hoff	b825d1c800	Improve error handling/logging for perspectives-key fetching. ... In particular, don't give up on the first failure.	6 years ago
Richard van der Hoff	753b1270da	Require sig from origin server on perspectives responses	6 years ago
Richard van der Hoff	895b79ac2e	Factor out KeyFetchers from KeyRing ... Rather than have three methods which have to have the same interface, factor out a separate interface which is provided by three implementations. I find it easier to grok the code this way.	6 years ago
Richard van der Hoff	b75537beaf	Store key validity time in the storage layer ... This is a first step to checking that the key is valid at the required moment. The idea here is that, rather than passing VerifyKey objects in and out of the storage layer, we instead pass FetchKeyResult objects, which simply wrap the VerifyKey and add a valid_until_ts field.	6 years ago
Richard van der Hoff	84660d91b2	Simplify process_v2_response (#5236) ... * Pass time_added_ms into process_v2_response * Simplify process_v2_response We can merge old_verify_keys into verify_keys, and reduce the number of dicts flying around.	6 years ago